---
typeId: req
recordId: benac-crypto-006
fields:
  title: Signed claim target binding
  statement: Signed claims shall bind explicitly to a typed target reference. For
    content-addressed target objects, the typed target reference shall include
    target DASL CID, target CID codec, target Benac object type or role, and
    target schema/profile identifier where applicable. For non-content-addressed
    targets, including principals, authentication sessions, names, or other
    identifier classes, the typed target reference shall include target
    identifier class, profile-defined target identifier, target type or role,
    and applicable identifier/profile version. All signed claims shall bind
    claim type, issuer principal, cryptographic profile, signed-claim envelope
    profile, content-identity profile where applicable, structured-object
    encoding profile where applicable, and claim payload used for signature
    verification. A claim
    about one target identifier, object, role, profile, issuer, or claim type
    shall not be transferable to another.
  rationale: A claim about one exact object, role, profile, or claim type must not
    be transferable to another object or misread under another profile.
  verification: Claim substitution tests fail verification or policy evaluation
    when the target identifier class, target identifier, target CID, target CID
    codec, object type, role, schema/profile, claim type, issuer, cryptographic
    profile, signed-claim envelope profile, content-identity profile,
    structured-object encoding profile, or signed payload changes.
  testable: true
  status: draft
  area: BENAC-CRYPTO
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.1 Cryptographic identity, content identity, and provenance foundation
  order: 6
---
